EMT Practice Test

1. Question Content...

---

Question1: A user wants to convert numeric field values to strings and also to sort on those values.
Which command should be used first, the eval or the sort?

Question2: Which of the following Statements about macros is true? (select all that apply)

Question3: Data model are composed of one or more of which of the following datasets? (select all that apply.)

Question4: Which of the following statements describes the use of the Field Extractor (FX)?

Question5: A report scheduled to run every 15 mins. but takes 17 mins. to complete is in danger of being_____.

Question6: Which of the following statements about event types is true? (select all that apply)

Question7: By default, how is acceleration configured in the Splunk Common Information Model (CIM) add-on?

Question8: Which of the following is NOT a stats function:

Question9: Select this in the fields sidebar to automatically pipe you search results to the rare command

Question10: When you mouse over and click to add a search term this (thesE. Boolean operator(s) is(arE. not implied.
(Select all that apply).

Question11: In the following eval statement, what is the value of description if the status is 503? index=main | eval description=case(status==200, "OK", status==404, "Not found", status==500, "Internal Server Error")

Question12: Alert throttling is used to _______.

Question13: Use this command to use lookup fields in a search and see the lookup fields in the field sidebar.

Question14: Which of the following actions can the eval command perform?

Question15: A calculated field maybe based on which of the following?

Question16: What does the fillnull command replace null values with, if the value argument is not specified?

Question17: Which of the following statements describes Search workflow actions?

Question18: These allow you to categorize events based on search terms.
Select your answer.

Question19: What is the correct syntax to search for a tag associated with a value on a specific fields?

Question20: In this search, __________ will appear on the y-axis. SEARCH: sourcetype=access_combined status!=200 | chart count over host

Question21: Which of the following searches will show the number of categoryld used by each host?

Question22: Which of the following is the correct way to use the data model command to search field in the data model within the web dataset?

Question23: How is a Search Workflow Action configured to run at the same time range as the original search?

Question24: There are several ways to access the field extractor. Which option automatically identifies data type, source type, and sample event?

Question25: When is a GET workflow action needed?

Question26: Which of the following statements describes POST workflow actions?

Question27: When should you use the transaction command instead of the scats command?

Question28: When extracting fields, we may choose to use our own regular expressions

Question29: Which of the following statements describe the search below? (select all that apply) Index=main I transaction clientip host maxspan=30s maxpause=5s

Question30: This function of the stats command allows you to return the middle-most value of field X.

Question31: When should transaction be used?

Question32: Which of the following eval command functions is valid?

Question33: This function of the stats command allows you to identify the number of values a field has.

Question34: What is required for a macro to accept three arguments?

Question35: Field aliases are used to __________ data

Question36: A real-time alert is ______________.

Question37: Which of the following statements describes the command below (select all that apply) Sourcetype=access_combined | transaction JSESSIONID

Question38: The gauge command:

Question39: Which of the following eval command function is valid?

Question40: Which group of users would most likely use pivots?

Question41: Calculated fields can be based on which of the following?

Question42: Which command is used to create choropleth maps?

Question43: Consider the following search:
Index=web sourcetype=access_combined
The log shows several events that share the same JSESSIONID value (SD404K289O2F151). View the events as a group. From the following list, which search groups events by JSESSIONID?

Question44: When can a pipe follow a macro?

Question45: The time range specified for a historical search defines the ____________ .------questionable on ans

Question46: This function of the stats command allows you to return the sample standard deviation of a field.

Question47: When using timechart, how many fields can be listed after a by clause?

Question48: To identify all of the contributing events within a transaction that contains at least one REJECT event, which syntax is correct?

Question49: Which of the following are required to create a POST workflow action?

Question50: Complete the search, .... | _____ failure>successes

Question51: Which of the following statements describes POST workflow actions?

Question52: Which of the following search control will not re-rerun the search? (Select all that apply.)

Question53: When performing a regular expression (regex) field extraction using the Field Extractor (FX), what happens when the require option is used?

Question54: Which of the following search modes automatically returns all extracted fields in the fields sidebar?

Question55: When using a split series on a chart, the series MUST be displayed using the STACKED option.

Question56: Which statement is true?

Question57: If a search returns ____________ it can be viewed as a chart.

Question58: These users can create global knowledge objects. (Select all that apply.)

Question59: A field alias has been created based on an original field. A search without any transforming commands is then executed in Smart Mode. Which field name appears in the results?

Question60: In most large Splunk environments, what is the most efficient command that can be used to group events by fields/

Question61: After manually editing; a regular expression (regex), which of the following statements is true?

Question62: Which of the following is a function of the Splunk Common Information Model (CIM)?

Question63: Which of the following searches would return a report of sales by product-name?

Question64: Where are the results of eval commands stored?

Question65: When using | timchart by host, which filed is representted in the x-axis?

Question66: Which are valid ways to create an event type? (select all that apply)

Question67: Calculated fields can be based on which of the following?

Question68: Which command can include both an over and a by clause to divide results into sub-groupings?

Question69: What are the two parts of a root event dataset?

Question70: Selected fields are displayed ______each event in the search results.

Question71: What information must be included when using the datamodel command?

Question72: These allow you to categorize events based on search terms.
Select your answer.

Question73: Which method in the Field Extractor would extract the port number from the following event? |
10/20/2022 - 125.24.20.1 ++++ port 54 - user: admin <web error>

Question74: In what order arc the following knowledge objects/configurations applied?

Question75: The eval command 'if' function requires the following three arguments (in order):

Question76: Which of these is NOT a field that is automatically created with the transaction command?

Question77: What other syntax will produce exactly the same results as | chart count over vendor_action by user?

Question78: These kinds of charts represent a series in a single bar with multiple sections

Question79: What is a limitation of searches generated by workflow actions?

Question80: In the Field Extractor Utility, this button will display events that do not contain extracted fields.
Select your answer.

Question81: Which of the following are valid options with the chart command ?(select all that apply)

Question82: Which workflow uses field values to perform a secondary search?

Question83: Which of the following statements about data models and pivot are true? (select all that apply)

Question84: What does the Splunk Common Information Model (CIM) add-on include? (select all that apply)